HashPatternDetector (Javadocs [I2P+ 2.11.0+]

java.lang.Object
- net.i2p.router.HashPatternDetector

All Implemented Interfaces:

Serializable
```
public class HashPatternDetector
extends Object
implements Serializable
```
Detects patterns in router hashes to predictively ban algorithmically-generated identities. Tracks byte patterns from banned routers and applies predictive bans when confidence is high.

See Also:

Serialized Form

Constructor Summary

Constructors
Constructor and Description

HashPatternDetector(RouterContext context)

Constructors
Constructor and Description
`HashPatternDetector(RouterContext context)`

Method Summary

All Methods Instance Methods Concrete Methods
Modifier and Type	Method and Description
`boolean`	`analyzeAndPredict(Hash hash, RouterContext context)` Analyze a router hash and apply predictive ban if pattern matches known attack signatures.
`boolean`	`detectCrossPrefixPatterns(List<String> hashes)` Check for cross-prefix sequential patterns (e.g., 0xAA01FF -> 0xAA0200).
`boolean`	`detectSequentialPatterns(List<String> hashes)` Detect sequential patterns by analyzing gaps between sorted hashes.
`void`	`disablePredictiveBanning()` Disable predictive banning manually or after recovery period.
`String`	`getHashPrefix(Hash hash)` Public method to get the hex prefix of a hash.
`long`	`getRemainingRecoveryTime()` Get remaining recovery time in milliseconds.
`Set<String>`	`getSuspiciousPrefixes()` Get suspicious prefixes that are part of a sequential pattern.
`boolean`	`hasScriptedPattern(List<String> hashes)` Quick check for scripted patterns - returns true if any pattern detected.
`boolean`	`hasSequentialPattern()` Check if recorded prefixes show sequential/counter patterns indicating algorithmic generation.
`boolean`	`isPredictiveBanningActive()` Check if predictive banning is currently active and within recovery period.
`void`	`recordBan(Hash hash, String reason)` Record a ban for pattern analysis.
`void`	`scanNetDBForPatterns()` Scan netDB for routers matching suspicious patterns and auto-ban them.
`void`	`startScanner()` Initialize the NetDB scanner with configured frequency.
`void`	`stopScanner()` Stop the NetDB scanner.

Methods inherited from class java.lang.Object
clone, equals, finalize, getClass, hashCode, notify, notifyAll, toString, wait, wait, wait

- Constructor Detail
  - HashPatternDetector
```
public HashPatternDetector(RouterContext context)
```
- Method Detail
  - analyzeAndPredict
```
public boolean analyzeAndPredict(Hash hash,
                                 RouterContext context)
```
    Analyze a router hash and apply predictive ban if pattern matches known attack signatures.
    
    Parameters:
    
    hash - Router hash to analyze
    
    context - Context for banlist operations
    
    Returns:
    
    true if predictively banned, false otherwise
  - detectCrossPrefixPatterns
```
public boolean detectCrossPrefixPatterns(List<String> hashes)
```
    Check for cross-prefix sequential patterns (e.g., 0xAA01FF -> 0xAA0200). Indicates scripted IDs crossing byte boundaries.
    
    Parameters:
    
    hashes - List of router hashes to analyze
    
    Returns:
    
    true if cross-prefix patterns detected
  - detectSequentialPatterns
```
public boolean detectSequentialPatterns(List<String> hashes)
```
    Detect sequential patterns by analyzing gaps between sorted hashes. Returns true if gap clustering suggests algorithmic generation.
    
    Parameters:
    
    hashes - List of router hashes to analyze
    
    Returns:
    
    true if sequential pattern detected
  - disablePredictiveBanning
```
public void disablePredictiveBanning()
```
    Disable predictive banning manually or after recovery period.
  - getHashPrefix
```
public String getHashPrefix(Hash hash)
```
    Public method to get the hex prefix of a hash. Used for logging predictive bans.
  - getRemainingRecoveryTime
```
public long getRemainingRecoveryTime()
```
    Get remaining recovery time in milliseconds.
    
    Returns:
    
    remaining time, or 0 if not in recovery
  - getSuspiciousPrefixes
```
public Set<String> getSuspiciousPrefixes()
```
    Get suspicious prefixes that are part of a sequential pattern.
    
    Returns:
    
    Set of suspicious prefix strings
  - hasScriptedPattern
```
public boolean hasScriptedPattern(List<String> hashes)
```
    Quick check for scripted patterns - returns true if any pattern detected.
    
    Parameters:
    
    hashes - List of router hashes to check
    
    Returns:
    
    true if scripted pattern detected
  - hasSequentialPattern
```
public boolean hasSequentialPattern()
```
    Check if recorded prefixes show sequential/counter patterns indicating algorithmic generation. This detects botnets that generate identities with incrementing counters.
    
    Returns:
    
    true if sequential pattern detected with high confidence
  - isPredictiveBanningActive
```
public boolean isPredictiveBanningActive()
```
    Check if predictive banning is currently active and within recovery period.
    
    Returns:
    
    true if predictive banning should be applied
  - recordBan
```
public void recordBan(Hash hash,
                      String reason)
```
    Record a ban for pattern analysis.
    
    Parameters:
    
    hash - Banned router hash
    
    reason - Ban reason
  - scanNetDBForPatterns
```
public void scanNetDBForPatterns()
```
    Scan netDB for routers matching suspicious patterns and auto-ban them. Uses gap-based detection for pre-emptive banning.
  - startScanner
```
public void startScanner()
```
    Initialize the NetDB scanner with configured frequency. Called after constructor to ensure all dependencies are ready.
  - stopScanner
```
public void stopScanner()
```
    Stop the NetDB scanner.

Class HashPatternDetector

Constructor Summary

Method Summary

Methods inherited from class java.lang.Object

Constructor Detail

HashPatternDetector

Method Detail

analyzeAndPredict

detectCrossPrefixPatterns

detectSequentialPatterns

disablePredictiveBanning

getHashPrefix

getRemainingRecoveryTime

getSuspiciousPrefixes

hasScriptedPattern

hasSequentialPattern

isPredictiveBanningActive

recordBan

scanNetDBForPatterns

startScanner

stopScanner